PHP: 218 products still vulnerable, NCSC-NL list (28/10/2026)
The 21 October PHP patch does not close the case. On 28 October the Dutch NCSC listed 218 products still vulnerable out of 757 tracked, and a third vector still has no patch.
In brief
On 28 October 2026 the Dutch National Cyber Security Centre (NCSC-NL) updated its public inventory of products affected by the two critical PHP flaws released on 21 October (CVE-2026-109618 and CVE-2026-109619).[1] Of 757 products tracked, 218 are still classed as vulnerable and only 144 are fixed; 354 remain under investigation.[1] In the 27 October version of its alert, the French CERT-FR reports exploitation attempts against specific deployments and notes that a third flaw, CVE-2026-115560, will not be patched before PHP next regular release cycle.[2]
What the 21 October patch does not settle
On 21 October PHP published versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35 to close two flaws that allow unauthenticated remote code execution on any PHP installation serving web requests.[3] Many SMEs asked their host if it was up to date and stopped there. The 28 October inventory shows the question is the wrong one: the brochure site is often only one product among several. PHP is also embedded in appliances, admin interfaces and line-of-business software that the administrator cannot patch directly.[1]
On 27 October CERT-FR adds two useful facts. It is seeing exploitation attempts against the two 21 October flaws, limited to specific deployments, and it has known of proof-of-concept code since 22 October.[2] The third flaw, announced by PHP on 23 October, requires an unusual combination of configuration and application code; PHP calls it unlikely and defers the fix to the next cycle.[2][3] Unlikely is not zero: until the fix ships, the workaround PHP published stays in place.
What changes for an SME, country by country
The engine is the same in all four countries. What changes is whom you notify, and how the patching duty reads.
- Netherlands. NCSC-NL holds the reference inventory, updated on 28 October at 16:22 Paris time.[1] An entity covered by the Cyberbeveiligingswet reports an incident to the NCSC and its sector authority, under the regime already in force. An SME outside that scope has no such legal duty, but the same repository tells it which software on its estate is still open.
- France. The reference alert is CERTFR-2026-ALE-014, last updated on 27 October.[2] An incident is reported to CERT-FR. Because NIS2 transposition is not complete, the NIS2 notification duty does not yet apply as it does in the Netherlands or Belgium: that does not excuse leaving an exposed site unpatched.
- Belgium. The Centre for Cybersecurity Belgium (CCB) is the notification point for essential and important entities already covered by the Belgian NIS2 act. An SME outside that scope reports a compromise to its provider and, if personal data leaks, to the Data Protection Authority.
- Luxembourg. The Institut luxembourgeois de regulation (ILR) supervises NIS2 entities; other organisations route an incident through CIRCL. A personal-data breach remains a matter for the CNPD, separate from the technical flaw.
The third vector, the one the patch does not close
On 23 October PHP published an informational advisory, not a patch: until the next release, it recommends disabling session upload progress (session.upload_progress.enabled=0) to close a vector it considers unlikely, tracked as CVE-2026-115560.[3] PHP states the issue arises only if the application switches the session serialize handler at runtime, and only if that progress feature is still enabled. An application that never changes the handler can leave the feature on.[3] CERT-EU, in version 1.2 of its 23 October advisory, takes the same line: no out-of-band release, apply the workaround.[4]
A second detail, dated 26 October, matters mainly for Windows servers: PHP rebuilt its Windows packages (a -1 suffix) to include Brotli 1.2.1, which fixes an out-of-bounds write in decompression, reachable through the cURL extension when automatic HTTP response decompression is enabled.[3] This is not the same flaw as the 21 October pair. An SME whose site runs on Windows must ask for the rebuilt package, not only the PHP version number.
Do this week
Five checks, in order.
- Ask the host for the exact PHP version of the site, not a vague yes. The versions that fix the two 21 October flaws are 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Branches 8.1 and older no longer receive updates from the PHP project: you need a vendor backport, or a migration.[3]
- List the other software that embeds PHP: shop, form, quoting tool, firewall interface, the provider appliance. NCSC-NL tracks 757; 218 were still vulnerable on 28 October.[1]
- Until the next PHP cycle is installed, have session upload progress disabled, then restart the PHP processes. That setting does not replace the update for the two 21 October flaws.[3]
- On Windows, require the rebuilt package of 26 October (the -1 suffix), not only the right version number.[3]
- If the site was exposed without a fix since 21 October, do not stop at updating: have the server logs reviewed for that period, and prepare notification (NCSC in the Netherlands, CERT-FR in France, CCB in Belgium, CIRCL and ILR in Luxembourg) if a compromise is confirmed.
At CyberNovaLabs.io
A site update cannot be guessed from the outside, and an inventory of 757 products is not a ten-minute read. CyberNovaLabs.io checks the version actually served, the embedded software and the workaround still open, then returns a short list of what remains. The cybersecurity offer is on the cybersecurity for SMEs page; for a look at your site, book a meeting. Two related reads: the critical PHP flaws of 21 October and the Brotli flaw fixed in the Windows packages.
Sources
- NCSC-NL, depot php2shell, point operationnel du 28 octobre 2026 (757 produits suivis, 218 vulnerables, 144 corriges)
- CERT-FR, alerte CERTFR-2026-ALE-014, derniere version du 27 octobre 2026
- PHP.net, avis informatif du 23 octobre 2026 (CVE-2026-115560) et paquets Windows du 26 octobre 2026
- CERT-EU, avis 2026-018, version 1.2 du 23 octobre 2026
Qualified meetings, no lock-in.
Criteria in writing before launch, pay per meeting or monthly, stop with a simple email.
Read next
Belgian tax portal attacked: deadline moved (28/10/2026)
Four days without MyMinfin, Tax-on-Web or Biztax, and a filing deadline that did not move. No data was stolen, so the cost sits elsewhere. What the Belgian tax portal cyberattack changes in practice for an SME in Belgium, France, the Netherlands and Luxembourg.
Read the article →November 3, 2026 · 9 min readAI Act 2026: what SMEs actually need to know
Applicable since 2 August 2026, the AI Act comes down to three duties for an SME that buys AI. The heavy Annex III rules now wait until 2 December 2027. Here are the dates, the fine ceilings that actually apply to an SME, and who enforces in the Netherlands, Belgium, France and Luxembourg.
Read the article →October 30, 2026 · 7 min readNIS2 Luxembourg: are law firms in scope?
A Luxembourg law firm is not a NIS2 entity. Three side doors in the Law of 5 May 2026 reach it anyway, and Article 35 of the 1991 Act imposes a constraint the cyber law ignores.
Read the article →October 29, 2026 · 9 min readB2B appointment setting for estate and letting agents
Agencies, property managers, managing agents: B2B appointment setting is allowed in all four countries, but the Belgian code of conduct follows your provider and Dutch law changes with the legal form of the firm you call. What to check before the first call.
Read the article →October 27, 2026 · 7 min readBrotli flaw: Node.js patched, then .NET out-of-band (25/10/2026)
One Brotli flaw triggered two separate fixes in four days, first at Node.js, then at Microsoft. The defect belongs to neither: it comes from a Google library that both of them bundle. For an SME, the useful question is not "do we run Node.js?" but "what is inside the software we run, and who updates it?".
Read the article →October 27, 2026 · 7 min readB2B cold call script: a framework that doesn't sound scripted
A recited script is audible in the first second. Here is a six-block framework with one mandatory sentence per block, the wording the authorities require in four countries, and the formula that tells you how many calls fill a diary.
Read the article →